PSA 330

Auditing Standards and Practices Council

PHILIPPINE STANDARD ON AUDITING 330

THE AUDITOR’S PROCEDURES

IN RESPONSE TO ASSESSED RISKS
 PSA 330

PHILIPPINE STANDARD ON AUDITING 330

THE AUDITOR’S PROCEDURES IN RESPONSE TO ASSESSED RISKS

(Effective for audits of financial statements for periods beginning
on or after December 15, 2004)

CONTENTS

Paragraphs

Introduction 1–3

Overall Responses 4–6

Audit Procedures Responsive to Risks of Material

Misstatement at the Assertion Level 7–9

Considering the Nature, Timing, and Extent of Further

Audit Procedures 10–21

Tests of Controls 22–47

Substantive Procedures 48–64

Adequacy of Presentation and Disclosure 65

Evaluating the Sufficiency and Appropriateness of 66–72

Audit Evidence Obtained

Documentation 73

Effective Date 74

Acknowledgment 75-76

Philippine Standard on Auditing (PSA) 330, “The Auditor’s Procedures in Response to Assessed
Risks,” should be read in the context of the “Preface to the Philippine Standards on Quality
Control, Auditing, Review, Other Assurance and Related Services,” which sets out the
application and authority of PSAs.
 PSA 330

THE AUDITOR’S PROCEDURES IN RESPONSE TO ASSESSED RISKS

Introduction

1. The purpose of this Philippine Standard on Auditing (PSA) is to establish

standards and provide guidance on determining overall responses and designing
and performing further audit procedures to respond to the assessed risks of
material misstatement at the financial statement and assertion levels in a financial
statement audit. The auditor’s understanding of the entity and its environment,
including its internal control, and assessment of the risks of material misstatement
are described in PSA 315, “Understanding the Entity and Its Environment and
Assessing the Risks of Material Misstatement.”

2. The following is an overview of the requirements of this standard:

• Overall responses. This section requires the auditor to determine overall

responses to address risks of material misstatement at the financial statement
level and provides guidance on the nature of those responses.

• Audit procedures responsive to risks of material misstatement at the assertion

level. This section requires the auditor to design and perform further audit
procedures, including tests of the operating effectiveness of controls, when
relevant or required, and substantive procedures, whose nature, timing, and
extent are responsive to the assessed risks of material misstatement at the
assertion level. In addition, this section includes matters the auditor considers
in determining the nature, timing, and extent of such audit procedures.

• Evaluating the sufficiency and appropriateness of audit evidence obtained.

This section requires the auditor to evaluate whether the risk assessment
remains appropriate and to conclude whether sufficient appropriate audit
evidence has been obtained.

• Documentation. This section establishes related documentation requirements.

3. In order to reduce audit risk to an acceptably low level, the auditor should
determine overall responses to assessed risks at the financial statement level,
and should design and perform further audit procedures to respond to
assessed risks at the assertion level. The overall responses and the nature,
timing, and extent of the further audit procedures are matters for the professional
judgment of the auditor. In addition to the requirements of this PSA, the auditor
also complies with the requirements and guidance in PSA 240, “The Auditor’s
Responsibility to Consider Fraud and Error in an Audit of Financial Statements”
in responding to assessed risks of material misstatement due to fraud.
 PSA 330
-2-

Overall Responses

4. The auditor should determine overall responses to address the risks of

material misstatement at the financial statement level. Such responses may
include emphasizing to the audit team the need to maintain professional
skepticism in gathering and evaluating audit evidence, assigning more
experienced staff or those with special skills or using experts,1 providing more
supervision, or incorporating additional elements of unpredictability in the
selection of further audit procedures to be performed. Additionally, the auditor
may make general changes to the nature, timing, or extent of audit procedures as
an overall response, for example, performing substantive procedures at period end
instead of at an interim date.

5. The assessment of the risks of material misstatement at the financial statement

level is affected by the auditor’s understanding of the control environment. An
effective control environment may allow the auditor to have more confidence in
internal control and the reliability of audit evidence generated internally within
the entity and thus, for example, allow the auditor to conduct some audit
procedures at an interim date rather than at period end. If there are weaknesses in
the control environment, the auditor ordinarily conducts more audit procedures as
of the period end rather than at an interim date, seeks more extensive audit
evidence from substantive procedures, modifies the nature of audit procedures to
obtain more persuasive audit evidence, or increases the number of locations to be
included in the audit scope.

6. Such considerations, therefore, have a significant bearing on the auditor’s general

approach, for example, an emphasis on substantive procedures (substantive
approach), or an approach that uses tests of controls as well as substantive
procedures (combined approach).

Audit Procedures Responsive to Risks of Material Misstatement at the Assertion

Level

7. The auditor should design and perform further audit procedures whose
nature, timing, and extent are responsive to the assessed risks of material
misstatement at the assertion level. The purpose is to provide a clear linkage
between the nature, timing, and extent of the auditor’s further audit procedures
and the risk assessment. In designing further audit procedures, the auditor
considers such matters as the following:

• The significance of the risk.

• The likelihood that a material misstatement will occur.

1
The assignment of engagement personnel to the particular engagement reflects the auditor’s risk
assessment, which is based on the auditor’s understanding of the entity.
 PSA 330
-3-

• The characteristics of the class of transactions, account balance, or disclosure

involved.

• The nature of the specific controls used by the entity and in particular whether
they are manual or automated.

• Whether the auditor expects to obtain audit evidence to determine if the

entity’s controls are effective in preventing, or detecting and correcting,
material misstatements.

The nature of the audit procedures is of most importance in responding to the

assessed risks.

8. The auditor’s assessment of the identified risks at the assertion level provides a
basis for considering the appropriate audit approach for designing and performing
further audit procedures. In some cases, the auditor may determine that only by
performing tests of controls may the auditor achieve an effective response to the
assessed risk of material misstatement for a particular assertion. In other cases,
the auditor may determine that performing only substantive procedures is
appropriate for specific assertions and, therefore, the auditor excludes the effect of
controls from the relevant risk assessment. This may be because the auditor’s risk
assessment procedures have not identified any effective controls relevant to the
assertion, or because testing the operating effectiveness of controls would be
inefficient. However, the auditor needs to be satisfied that performing only
substantive procedures for the relevant assertion would be effective in reducing
the risk of material misstatement to an acceptably low level. Often the auditor
may determine that a combined approach using both tests of the operating
effectiveness of controls and substantive procedures is an effective approach.
Irrespective of the approach selected, the auditor designs and performs
substantive procedures for each material class of transactions, account balance,
and disclosure as required by paragraph 49.

9. In the case of very small entities, there may not be many control activities that
could be identified by the auditor. For this reason, the auditor’s further audit
procedures are likely to be primarily substantive procedures. In such cases, in
addition to the matters referred to in paragraph 8 above, the auditor considers
whether in the absence of controls it is possible to obtain sufficient appropriate
audit evidence.
 PSA 330
-4-

CONSIDERING THE NATURE, TIMING, AND EXTENT OF FURTHER AUDIT

PROCEDURES

Nature

10. The nature of further audit procedures refers to their purpose (tests of controls or
substantive procedures) and their type, that is, inspection, observation, inquiry,
confirmation, recalculation, reperformance, or analytical procedures. Certain
audit procedures may be more appropriate for some assertions than others. For
example, in relation to revenue, tests of controls may be most responsive to the
assessed risk of misstatement of the completeness assertion, whereas substantive
procedures may be most responsive to the assessed risk of misstatement of the
occurrence assertion.

11. The auditor’s selection of audit procedures is based on the assessment of risk.
The higher the auditor’s assessment of risk, the more reliable and relevant is the
audit evidence sought by the auditor from substantive procedures. This may
affect both the types of audit procedures to be performed and their combination.
For example, the auditor may confirm the completeness of the terms of a contract
with a third party, in addition to inspecting the document.

12. In determining the audit procedures to be performed, the auditor considers the
reasons for the assessment of the risk of material misstatement at the assertion
level for each class of transactions, account balance, and disclosure. This
includes considering both the particular characteristics of each class of
transactions, account balance, or disclosure (i.e., the inherent risks) and whether
the auditor’s risk assessment takes account of the entity’s controls (i.e., the
control risk). For example, if the auditor considers that there is a lower risk that a
material misstatement may occur because of the particular characteristics of a
class of transactions without consideration of the related controls, the auditor may
determine that substantive analytical procedures alone may provide sufficient
appropriate audit evidence. On the other hand, if the auditor expects that there is
a lower risk that a material misstatement may arise because an entity has effective
controls and the auditor intends to design substantive procedures based on the
effective operation of those controls, then the auditor performs tests of controls to
obtain audit evidence about their operating effectiveness. This may be the case,
for example, for a class of transactions of reasonably uniform, non-complex
characteristics that are routinely processed and controlled by the entity’s
information system.

13. The auditor is required to obtain audit evidence about the accuracy and
completeness of information produced by the entity’s information system when
that information is used in performing audit procedures. For example, if the
auditor uses non-financial information or budget data produced by the entity’s
information system in performing audit procedures, such as substantive analytical
 PSA 330
-5-

procedures or tests of controls, the auditor obtains audit evidence about the
accuracy and completeness of such information. See PSA 500, “Audit Evidence”
paragraph 11 for further guidance.

Timing

14. Timing refers to when audit procedures are performed or the period or date to
which the audit evidence applies.

15. The auditor may perform tests of controls or substantive procedures at an interim
date or at period end. The higher the risk of material misstatement, the more
likely it is that the auditor may decide it is more effective to perform substantive
procedures nearer to, or at, the period end rather than at an earlier date, or to
perform audit procedures unannounced or at unpredictable times (for example,
performing audit procedures at selected locations on an unannounced basis). On
the other hand, performing audit procedures before the period end may assist the
auditor in identifying significant matters at an early stage of the audit, and
consequently resolving them with the assistance of management or developing an
effective audit approach to address such matters. If the auditor performs tests of
controls or substantive procedures prior to period end, the auditor considers the
additional evidence required for the remaining period (see paragraphs 37-38 and
56-61).

16. In considering when to perform audit procedures, the auditor also considers such
matters as the following:

• The control environment.

• When relevant information is available (for example, electronic files may

subsequently be overwritten, or procedures to be observed may occur only at
certain times).

• The nature of the risk (for example, if there is a risk of inflated revenues to
meet earnings expectations by subsequent creation of false sales agreements,
the auditor may wish to examine contracts available on the date of the period
end).

• The period or date to which the audit evidence relates.

17. Certain audit procedures can be performed only at or after period end, for
example, agreeing the financial statements to the accounting records and
examining adjustments made during the course of preparing the financial
statements. If there is a risk that the entity may have entered into improper sales
contracts or transactions may not have been finalized at period end, the auditor
performs procedures to respond to that specific risk. For example, when
 PSA 330
-6-

transactions are individually material or an error in cutoff may lead to a material

misstatement, the auditor ordinarily inspects transactions near the period end.

Extent

18. Extent includes the quantity of a specific audit procedure to be performed, for
example, a sample size or the number of observations of a control activity. The
extent of an audit procedure is determined by the judgment of the auditor after
considering the materiality, the assessed risk, and the degree of assurance the
auditor plans to obtain. In particular, the auditor ordinarily increases the extent of
audit procedures as the risk of material misstatement increases. However,
increasing the extent of an audit procedure is effective only if the audit procedure
itself is relevant to the specific risk; therefore, the nature of the audit procedure is
the most important consideration.

19. The use of computer-assisted audit techniques (CAATs) may enable more
extensive testing of electronic transactions and account files. Such techniques can
be used to select sample transactions from key electronic files, to sort transactions
with specific characteristics, or to test an entire population instead of a sample.

20. Valid conclusions may ordinarily be drawn using sampling approaches.

However, if the quantity of selections made from a population is too small, the
sampling approach selected is not appropriate to achieve the specific audit
objective, or if exceptions are not appropriately followed up, there will be an
unacceptable risk that the auditor’s conclusion based on a sample may be different
from the conclusion reached if the entire population was subjected to the same
audit procedure. PSA 530, “Audit Sampling and Other Selective Testing
Procedures” contains guidance on the use of sampling.

21. This standard regards the use of different audit procedures in combination as an
aspect of the nature of testing as discussed above. However, the auditor considers
whether the extent of testing is appropriate when performing different audit
procedures in combination.

TESTS OF CONTROLS

22. The auditor is required to perform tests of controls when the auditor’s risk
assessment includes an expectation of the operating effectiveness of controls or
when substantive procedures alone do not provide sufficient appropriate audit
evidence at the assertion level.

23. When the auditor’s assessment of risks of material misstatement at the

assertion level includes an expectation that controls are operating effectively,
the auditor should perform tests of controls to obtain sufficient appropriate
audit evidence that the controls were operating effectively at relevant times
during the period under audit. See paragraphs 39-44 below for discussion of
 PSA 330
-7-

using audit evidence about the operating effectiveness of controls obtained in

prior audits.

24. The auditor’s assessment of risk of material misstatement at the assertion level
may include an expectation of the operating effectiveness of controls, in which
case the auditor performs tests of controls to obtain audit evidence as to their
operating effectiveness. Tests of the operating effectiveness of controls are
performed only on those controls that the auditor has determined are suitably
designed to prevent, or detect and correct, a material misstatement in an assertion.
Paragraphs 104-106 of PSA 315 discuss the identification of controls at the
assertion level likely to prevent, or detect and correct, a material misstatement in a
class of transactions, account balance or disclosure.

25. When, in accordance with paragraph 115 of PSA 315, the auditor has
determined that it is not possible or practicable to reduce the risks of
material misstatement at the assertion level to an acceptably low level with
audit evidence obtained only from substantive procedures, the auditor
should perform tests of relevant controls to obtain audit evidence about their
operating effectiveness. For example, as discussed in paragraph 115 of PSA
315, the auditor may find it impossible to design effective substantive procedures
that by themselves provide sufficient appropriate audit evidence at the assertion
level when an entity conducts its business using IT and no documentation of
transactions is produced or maintained, other than through the IT system.

26. Testing the operating effectiveness of controls is different from obtaining audit
evidence that controls have been implemented. When obtaining audit evidence of
implementation by performing risk assessment procedures, the auditor determines
that the relevant controls exist and that the entity is using them. When performing
tests of the operating effectiveness of controls, the auditor obtains audit evidence
that controls operate effectively. This includes obtaining audit evidence about
how controls were applied at relevant times during the period under audit, the
consistency with which they were applied, and by whom or by what means they
were applied. If substantially different controls were used at different times
during the period under audit, the auditor considers each separately. The auditor
may determine that testing the operating effectiveness of controls at the same time
as evaluating their design and obtaining audit evidence of their implementation is
efficient.
 PSA 330
-8-

27. Although some risk assessment procedures that the auditor performs to evaluate
the design of controls and to determine that they have been implemented may not
have been specifically designed as tests of controls, they may nevertheless
provide audit evidence about the operating effectiveness of the controls and,
consequently, serve as tests of controls. For example, the auditor may have made
inquiries about management’s use of budgets, observed management’s
comparison of monthly budgeted and actual expenses, and inspected reports
pertaining to the investigation of variances between budgeted and actual amounts.
These audit procedures provide knowledge about the design of the entity’s
budgeting policies and whether they have been implemented, and may also
provide audit evidence about the effectiveness of the operation of budgeting
policies in preventing or detecting material misstatements in the classification of
expenses. In such circumstances, the auditor considers whether the audit
evidence provided by those audit procedures is sufficient.

Nature of Tests of Controls

28. The auditor selects audit procedures to obtain assurance about the operating
effectiveness of controls. As the planned level of assurance increases, the auditor
seeks more reliable audit evidence. In circumstances when the auditor adopts an
approach consisting primarily of tests of controls, in particular related to those
risks where it is not possible or practicable to obtain sufficient appropriate audit
evidence only from substantive procedures, the auditor ordinarily performs tests
of controls to obtain a higher level of assurance about their operating
effectiveness.

29. The auditor should perform other audit procedures in combination with
inquiry to test the operating effectiveness of controls. Although different from
obtaining an understanding of the design and implementation of controls, tests of
the operating effectiveness of controls ordinarily include the same types of audit
procedures used to evaluate the design and implementation of controls, and may
also include reperformance of the application of the control by the auditor. Since
inquiry alone is not sufficient, the auditor uses a combination of audit procedures
to obtain sufficient appropriate audit evidence regarding the operating
effectiveness of controls. Those controls subject to testing by performing inquiry
combined with inspection or reperformance ordinarily provide more assurance
than those controls for which the audit evidence consists solely of inquiry and
observation. For example, an auditor may inquire about and observe the entity’s
procedures for opening the mail and processing cash receipts to test the operating
effectiveness of controls over cash receipts. Because an observation is pertinent
only at the point in time at which it is made, the auditor ordinarily supplements
the observation with inquiries of entity personnel, and may also inspect
documentation about the operation of such controls at other times during the audit
period in order to obtain sufficient appropriate audit evidence.
 PSA 330
-9-

30. The nature of the particular control influences the type of audit procedure required
to obtain audit evidence about whether the control was operating effectively at
relevant times during the period under audit. For some controls, operating
effectiveness is evidenced by documentation. In such circumstances, the auditor
may decide to inspect the documentation to obtain audit evidence about operating
effectiveness. For other controls, however, such documentation may not be
available or relevant. For example, documentation of operation may not exist for
some factors in the control environment, such as assignment of authority and
responsibility, or for some types of control activities, such as control activities
performed by a computer. In such circumstances, audit evidence about operating
effectiveness may be obtained through inquiry in combination with other audit
procedures such as observation or the use of CAATs.

31. In designing tests of controls, the auditor considers the need to obtain audit
evidence supporting the effective operation of controls directly related to the
assertions as well as other indirect controls on which these controls depend. For
example, the auditor may identify a user review of an exception report of credit
sales over a customer’s authorized credit limit as a direct control related to an
assertion. In such cases, the auditor considers the effectiveness of the user review
of the report and also the controls related to the accuracy of the information in the
report (for example, the general IT-controls).

32. In the case of an automated application control, because of the inherent

consistency of IT processing, audit evidence about the implementation of the
control, when considered in combination with audit evidence obtained regarding
the operating effectiveness of the entity’s general controls (and in particular,
change controls) may provide substantial audit evidence about its operating
effectiveness during the relevant period.

33. When responding to the risk assessment, the auditor may design a test of controls
to be performed concurrently with a test of details on the same transaction. The
objective of tests of controls is to evaluate whether a control operated effectively.
The objective of tests of details is to detect material misstatements at the assertion
level. Although these objectives are different, both may be accomplished
concurrently through performance of a test of controls and a test of details on the
same transaction, also known as a dual-purpose test. For example, the auditor
may examine an invoice to determine whether it has been approved and to
provide substantive audit evidence of a transaction. The auditor carefully
considers the design and evaluation of such tests to accomplish both objectives.
 PSA 330
- 10 -

34. The absence of misstatements detected by a substantive procedure does not

provide audit evidence that controls related to the assertion being tested are
effective. However, misstatements that the auditor detects by performing
substantive procedures are considered by the auditor when assessing the operating
effectiveness of related controls. A material misstatement detected by the
auditor’s procedures that was not identified by the entity ordinarily is indicative of
the existence of a material weakness in internal control, which is communicated
to management and those charged with governance.

Timing of Tests of Controls

35. The timing of tests of controls depends on the auditor’s objective and determines
the period of reliance on those controls. If the auditor tests controls at a particular
time, the auditor only obtains audit evidence that the controls operated effectively
at that time. However, if the auditor tests controls throughout a period, the
auditor obtains audit evidence of the effectiveness of the operation of the controls
during that period.

36. Audit evidence pertaining only to a point in time may be sufficient for the
auditor’s purpose, for example, when testing controls over the entity’s physical
inventory counting at the period end. If, on the other hand, the auditor requires
audit evidence of the effectiveness of a control over a period, audit evidence
pertaining only to a point in time may be insufficient and the auditor supplements
those tests with other tests of controls that are capable of providing audit evidence
that the control operated effectively at relevant times during the period under
audit. Such other tests may consist of tests of the entity’s monitoring of controls.

37. When the auditor obtains audit evidence about the operating effectiveness of
controls during an interim period, the auditor should determine what
additional audit evidence should be obtained for the remaining period. In
making that determination, the auditor considers the significance of the assessed
risks of material misstatement at the assertion level, the specific controls that were
tested during the interim period, the degree to which audit evidence about the
operating effectiveness of those controls was obtained, the length of the remaining
period, the extent to which the auditor intends to reduce further substantive
procedures based on the reliance of controls, and the control environment. The
auditor obtains audit evidence about the nature and extent of any significant
changes in internal control, including changes in the information system,
processes, and personnel that occur subsequent to the interim period.

38. Additional audit evidence may be obtained, for example, by extending the testing
of the operating effectiveness of controls over the remaining period or testing the
entity’s monitoring of controls.
 PSA 330
- 11 -

39. If the auditor plans to use audit evidence about the operating effectiveness of
controls obtained in prior audits, the auditor should obtain audit evidence
about whether changes in those specific controls have occurred subsequent to
the prior audit. The auditor should obtain audit evidence about whether
such changes have occurred by performing inquiry in combination with
observation or inspection to confirm the understanding of those specific
controls. Paragraph 23 of PSA 500 states that the auditor performs audit
procedures to establish the continuing relevance of audit evidence obtained in
prior periods when the auditor plans to use the audit evidence in the current
period. For example, in performing the prior audit, the auditor may have
determined that an automated control was functioning as intended. The auditor
obtains audit evidence to determine whether changes to the automated control
have been made that affect its continued effective functioning, for example,
through inquiries of management and the inspection of logs to indicate what
controls have been changed. Consideration of audit evidence about these changes
may support either increasing or decreasing the expected audit evidence to be
obtained in the current period about the operating effectiveness of the controls.

40. If the auditor plans to rely on controls that have changed since they were last
tested, the auditor should test the operating effectiveness of such controls in
the current audit. Changes may affect the relevance of the audit evidence
obtained in prior periods such that there may no longer be a basis for continued
reliance. For example, changes in a system that enable an entity to receive a new
report from the system probably do not affect the relevance of prior period audit
evidence; however, a change that causes data to be accumulated or calculated
differently does affect it.

41. If the auditor plans to rely on controls that have not changed since they were
last tested, the auditor should test the operating effectiveness of such controls
at least once in every third audit. As indicated in paragraphs 40 and 44, the
auditor may not rely on audit evidence about the operating effectiveness of
controls obtained in prior audits for controls that have changed since they were
last tested or controls that mitigate a significant risk. The auditor’s decision on
whether to rely on audit evidence obtained in prior audits for other controls is a
matter of professional judgment. In addition, the length of time period between
retesting such controls is also a matter of professional judgment, but cannot
exceed two years.

42. In considering whether it is appropriate to use audit evidence about the operating
effectiveness of controls obtained in prior audits, and, if so, the length of the time
period that may elapse before retesting a control, the auditor considers the
following:

• The effectiveness of other elements of internal control, including the control

environment, the entity’s monitoring of controls, and the entity’s risk
assessment process.
 PSA 330
- 12 -

• The risks arising from the characteristics of the control, including whether
controls are manual or automated (see PSA 315, paragraphs 57-63 for a
discussion of specific risks arising from manual and automated elements of a
control).

• The effectiveness of general IT-controls.

• The effectiveness of the control and its application by the entity, including the
nature and extent of deviations in the application of the control from tests of
operating effectiveness in prior audits.

• Whether the lack of a change in a particular control poses a risk due to

changing circumstances.

• The risk of material misstatement and the extent of reliance on the control.

In general, the higher the risk of material misstatement, or the greater the reliance
on controls, the shorter the time period elapsed, if any, is likely to be. Factors that
ordinarily decrease the period for retesting a control, or result in not relying on
audit evidence obtained in prior audits at all, include the following:

• A weak control environment.

• Weak monitoring of controls.

• A significant manual element to the relevant controls.

• Personnel changes that significantly affect the application of the control.

• Changing circumstances that indicate the need for changes in the control.

• Weak general IT-controls.

43. When there are a number of controls for which the auditor determines that it
is appropriate to use audit evidence obtained in prior audits, the auditor
should test the operating effectiveness of some controls each audit. The
purpose of this requirement is to avoid the possibility that the auditor might apply
the approach of paragraph 41 to all controls on which the auditor proposes to rely,
but test all those controls in a single audit period with no testing of controls in the
subsequent two audit periods. In addition to providing audit evidence about the
operating effectiveness of the controls being tested in the current audit,
performing such tests provides collateral evidence about the continuing
effectiveness of the control environment and therefore contributes to the decision
about whether it is appropriate to rely on audit evidence obtained in prior audits.
Therefore, when the auditor determines in accordance with paragraphs 39-42 that
 PSA 330
- 13 -

it is appropriate to use audit evidence obtained in prior audits for a number of

controls, the auditor plans to test a sufficient portion of the controls in that
population in each audit period, and at a minimum, each control is tested at least
every third audit.

44. When, in accordance with paragraph 108 of PSA 315, the auditor has
determined that an assessed risk of material misstatement at the assertion
level is a significant risk and the auditor plans to rely on the operating
effectiveness of controls intended to mitigate that significant risk, the auditor
should obtain the audit evidence about the operating effectiveness of those
controls from tests of controls performed in the current period. The greater
the risk of material misstatement, the more audit evidence the auditor obtains that
relevant controls are operating effectively. Accordingly, although the auditor
often considers information obtained in prior audits in designing tests of controls
to mitigate a significant risk, the auditor does not rely on audit evidence obtained
in a prior audit about the operating effectiveness of controls over such risks, but
instead obtains the audit evidence about the operating effectiveness of controls
over such risks in the current period.

Extent of Tests of Controls

45. The auditor designs tests of controls to obtain sufficient appropriate audit
evidence that the controls operated effectively throughout the period of reliance.
Matters the auditor may consider in determining the extent of the auditor’s tests of
controls include the following:

• The frequency of the performance of the control by the entity during the
period.

• The length of time during the audit period that the auditor is relying on the
operating effectiveness of the control.

• The relevance and reliability of the audit evidence to be obtained in

supporting that the control prevents, or detects and corrects, material
misstatements at the assertion level.

• The extent to which audit evidence is obtained from tests of other controls
related to the assertion.

• The extent to which the auditor plans to rely on the operating effectiveness of
the control in the assessment of risk (and thereby reduce substantive
procedures based on the reliance of such control).

• The expected deviation from the control.

 PSA 330
- 14 -

46. The more the auditor relies on the operating effectiveness of controls in the
assessment of risk, the greater is the extent of the auditor’s tests of controls. In
addition, as the rate of expected deviation from a control increases, the auditor
increases the extent of testing of the control. However, the auditor considers
whether the rate of expected deviation indicates that the control will not be
sufficient to reduce the risk of material misstatement at the assertion level to that
assessed by the auditor. If the rate of expected deviation is expected to be too
high, the auditor may determine that tests of controls for a particular assertion
may not be effective.

47. Because of the inherent consistency of IT processing, the auditor may not need to
increase the extent of testing of an automated control. An automated control
should function consistently unless the program (including the tables, files, or
other permanent data used by the program) is changed. Once the auditor
determines that an automated control is functioning as intended (which could be
done at the time the control is initially implemented or at some other date), the
auditor considers performing tests to determine that the control continues to
function effectively. Such tests might include determining that changes to the
program are not made without being subject to the appropriate program change
controls, that the authorized version of the program is used for processing
transactions, and that other relevant general controls are effective. Such tests also
might include determining that changes to the programs have not been made, as
may be the case when the entity uses packaged software applications without
modifying or maintaining them. For example, the auditor may inspect the record
of the administration of IT security to obtain audit evidence that unauthorized
access has not occurred during the period.

SUBSTANTIVE PROCEDURES

48. Substantive procedures are performed in order to detect material misstatements at

the assertion level, and include tests of details of classes of transactions, account
balances, and disclosures and substantive analytical procedures. The auditor
plans and performs substantive procedures to be responsive to the related
assessment of the risk of material misstatement.

49. Irrespective of the assessed risk of material misstatement, the auditor should
design and perform substantive procedures for each material class of
transactions, account balance, and disclosure. This requirement reflects the
fact that the auditor’s assessment of risk is judgmental and may not be sufficiently
precise to identify all risks of material misstatement. Further, there are inherent
limitations to internal control including management override. Accordingly,
while the auditor may determine that the risk of material misstatement may be
reduced to an acceptably low level by performing only tests of controls for a
particular assertion related to a class of transactions, account balance or disclosure
(see paragraph 8), the auditor always performs substantive procedures for each
material class of transactions, account balance, and disclosure.
 PSA 330
- 15 -

50. The auditor’s substantive procedures should include the following audit
procedures related to the financial statement closing process:

• Agreeing the financial statements to the underlying accounting records;

and

• Examining material journal entries and other adjustments made during

the course of preparing the financial statements. The nature and extent of
the auditor’s examination of journal entries and other adjustments depends on
the nature and complexity of the entity’s financial reporting process and the
associated risks of material misstatement.

51. When, in accordance with paragraph 108 of PSA 315, the auditor has
determined that an assessed risk of material misstatement at the assertion
level is a significant risk, the auditor should perform substantive procedures
that are specifically responsive to that risk. For example, if the auditor
identifies that management is under pressure to meet earnings expectations, there
may be a risk that management is inflating sales by improperly recognizing
revenue related to sales agreements with terms that preclude revenue recognition
or by invoicing sales before shipment. In these circumstances, the auditor may,
for example, design external confirmations not only to confirm outstanding
amounts, but also to confirm the details of the sales agreements, including date,
any rights of return and delivery terms. In addition, the auditor may find it
effective to supplement such external confirmations with inquiries of non-
financial personnel in the entity regarding any changes in sales agreements and
delivery terms.

52. When the approach to significant risks consists only of substantive procedures,
the audit procedures appropriate to address such significant risks consist of tests
of details only, or a combination of tests of details and substantive analytical
procedures The auditor considers the guidance in paragraphs 53-64 in designing
the nature, timing, and extent of substantive procedures for significant risks. In
order to obtain sufficient appropriate audit evidence, the substantive procedures
related to significant risks are most often designed to obtain audit evidence with
high reliability.
 PSA 330
- 16 -

Nature of Substantive Procedures

53. Substantive analytical procedures are generally more applicable to large volumes
of transactions that tend to be predictable over time. Tests of details are
ordinarily more appropriate to obtain audit evidence regarding certain assertions
about account balances, including existence and valuation. In some situations, the
auditor may determine that performing only substantive analytical procedures
may be sufficient to reduce the risk of material misstatement to an acceptably low
level. For example, the auditor may determine that performing only substantive
analytical procedures is responsive to the assessed risk of material misstatement
for a class of transactions where the auditor’s assessment of risk is supported by
obtaining audit evidence from performance of tests of the operating effectiveness
of controls. In other situations, the auditor may determine that only tests of
details are appropriate, or that a combination of substantive analytical procedures
and tests of details are most responsive to the assessed risks.

54. The auditor designs tests of details responsive to the assessed risk with the
objective of obtaining sufficient appropriate audit evidence to achieve the planned
level of assurance at the assertion level. In designing substantive procedures
related to the existence or occurrence assertion, the auditor selects from items
contained in a financial statement amount and obtains the relevant audit evidence.
On the other hand, in designing audit procedures related to the completeness
assertion, the auditor selects from audit evidence indicating that an item should be
included in the relevant financial statement amount and investigates whether that
item is so included. For example, the auditor might inspect subsequent cash
disbursements to determine whether any purchases had been omitted from
accounts payable.

55. In designing substantive analytical procedures, the auditor considers such matters
as the following:

• The suitability of using substantive analytical procedures given the assertions.

• The reliability of the data, whether internal or external, from which the
expectation of recorded amounts or ratios is developed.

• Whether the expectation is sufficiently precise to identify a material

misstatement at the desired level of assurance.

• The amount of any difference in recorded amounts from expected values that
is acceptable. The auditor considers testing the controls, if any, over the
entity’s preparation of information used by the auditor in applying analytical
procedures. When such controls are effective, the auditor has greater
confidence in the reliability of the information and, therefore, in the results of
analytical procedures. Alternatively, the auditor may consider whether the
information was subjected to audit testing in the current or prior period. In
 PSA 330
- 17 -

determining the audit procedures to apply to the information upon which the
expectation for substantive analytical procedures is based, the auditor
considers the guidance in paragraph 11 of PSA 500.

Timing of Substantive Procedures

56. When substantive procedures are performed at an interim date, the auditor
should perform further substantive procedures or substantive procedures
combined with tests of controls to cover the remaining period that provide a
reasonable basis for extending the audit conclusions from the interim date to
the period end.

57. In some circumstances, substantive procedures may be performed at an interim

date. This increases the risk that misstatements that may exist at the period end
are not detected by the auditor. This risk increases as the remaining period is
lengthened. In considering whether to perform substantive procedures at an
interim date, the auditor considers such factors as the following:

• The control environment and other relevant controls.

• The availability of information at a later date that is necessary for the auditor’s
procedures.

• The objective of the substantive procedure.

• The assessed risk of material misstatement.

• The nature of the class of transactions or account balance and related

assertions.

• The ability of the auditor to perform appropriate substantive procedures or

substantive procedures combined with tests of controls to cover the remaining
period in order to reduce the risk that misstatements that exist at period end
are not detected.

58. Although the auditor is not required to obtain audit evidence about the operating
effectiveness of controls in order to have a reasonable basis for extending audit
conclusions from an interim date to the period end, the auditor considers whether
performing only substantive procedures to cover the remaining period is
sufficient. If the auditor concludes that substantive procedures alone would not
be sufficient, tests of the operating effectiveness of relevant controls are
performed or the substantive procedures are performed as of the period end.

59. In circumstances where the auditor has identified risks of material misstatement
due to fraud, the auditor’s response to address those risks may include changing
the timing of audit procedures. For example, the auditor might conclude that,
 PSA 330
- 18 -

given the risks of intentional misstatement or manipulation, audit procedures to

extend audit conclusions from an interim date to the period end would not be
effective. In such circumstances, the auditor might conclude that substantive
procedures need to be performed at or near the end of the reporting period to
address an identified risk of material misstatement due to fraud (see PSA 240).

60. Ordinarily, the auditor compares and reconciles information concerning the
balance at the period end with the comparable information at the interim date to
identify amounts that appear unusual, investigates any such amounts, and
performs substantive analytical procedures or tests of details to test the
intervening period. When the auditor plans to perform substantive analytical
procedures with respect to the intervening period, the auditor considers whether
the period end balances of the particular classes of transactions or account
balances are reasonably predictable with respect to amount, relative significance,
and composition. The auditor considers whether the entity’s procedures for
analyzing and adjusting such classes of transactions or account balances at interim
dates and for establishing proper accounting cutoffs are appropriate. In addition,
the auditor considers whether the information system relevant to financial
reporting will provide information concerning the balances at the period end and
the transactions in the remaining period that is sufficient to permit investigation
of: significant unusual transactions or entries (including those at or near period
end); other causes of significant fluctuations, or expected fluctuations that did not
occur; and changes in the composition of the classes of transactions or account
balances. The substantive procedures related to the remaining period depend on
whether the auditor has performed tests of controls.

61. If misstatements are detected in classes of transactions or account balances at an

interim date, the auditor ordinarily modifies the related assessment of risk and the
planned nature, timing, or extent of the substantive procedures covering the
remaining period that relate to such classes of transactions or account balances, or
extends or repeats such audit procedures at the period end.

62. The use of audit evidence from the performance of substantive procedures in a
prior audit is not sufficient to address a risk of material misstatement in the
current period. In most cases, audit evidence from the performance of substantive
procedures in a prior audit provides little or no audit evidence for the current
period. In order for audit evidence obtained in a prior audit to be used in the
current period as substantive audit evidence, the audit evidence and the related
subject matter must not fundamentally change. An example of audit evidence
obtained from the performance of substantive procedures in a prior period that
may be relevant in the current year is a legal opinion related to the structure of a
securitization to which no changes have occurred during the current period. As
required by paragraph 23 of PSA 500, if the auditor plans to use audit evidence
obtained from the performance of substantive procedures in a prior audit, the
auditor performs audit procedures during the current period to establish the
continuing relevance of the audit evidence.
 PSA 330
- 19 -

Extent of the Performance of Substantive Procedures

63. The greater the risk of material misstatement, the greater the extent of substantive
procedures. Because the risk of material misstatement takes account of internal
control, the extent of substantive procedures may be increased as a result of
unsatisfactory results from tests of the operating effectiveness of controls.
However, increasing the extent of an audit procedure is appropriate only if the
audit procedure itself is relevant to the specific risk.

64. In designing tests of details, the extent of testing is ordinarily thought of in terms
of the sample size, which is affected by the risk of material misstatement.
However, the auditor also considers other matters, including whether it is more
effective to use other selective means of testing, such as selecting large or unusual
items from a population as opposed to performing representative sampling or
stratifying the population into homogeneous subpopulations for sampling. PSA
530 contains guidance on the use of sampling and other means of selecting items
for testing. In designing substantive analytical procedures, the auditor considers
the amount of difference from the expectation that can be accepted without further
investigation. This consideration is influenced primarily by materiality and the
consistency with the desired level of assurance. Determination of this amount
involves considering the possibility that a combination of misstatements in the
specific account balance, class of transactions, or disclosure could aggregate to an
unacceptable amount. In designing substantive analytical procedures, the auditor
increases the desired level of assurance as the risk of material misstatement
increases. PSA 520, “Analytical Procedures” contains guidance on the
application of analytical procedures during an audit.

ADEQUACY OF PRESENTATION AND DISCLOSURE

65. The auditor should perform audit procedures to evaluate whether the overall
presentation of the financial statements, including the related disclosures, are
in accordance with the applicable financial reporting framework. The auditor
considers whether the individual financial statements are presented in a manner
that reflects the appropriate classification and description of financial information.
The presentation of financial statements in conformity with the applicable
financial reporting framework also includes adequate disclosure of material
matters. These matters relate to the form, arrangement, and content of the
financial statements and their appended notes, including, for example, the
terminology used, the amount of detail given, the classification of items in the
statements, and the bases of amounts set forth. The auditor considers whether
management should have disclosed a particular matter in light of the
circumstances and facts of which the auditor is aware at the time. In performing
the evaluation of the overall presentation of the financial statements, including the
related disclosures, the auditor considers the assessed risk of material
misstatement at the assertion level. See paragraph 17 of PSA 500 for a description
of the assertions related to presentation and disclosure.
 PSA 330
- 20 -

Evaluating the Sufficiency and Appropriateness of Audit Evidence Obtained

66. Based on the audit procedures performed and the audit evidence obtained,
the auditor should evaluate whether the assessments of the risks of material
misstatement at the assertion level remain appropriate.

67. An audit of financial statements is a cumulative and iterative process. As the

auditor performs planned audit procedures, the audit evidence obtained may cause
the auditor to modify the nature, timing, or extent of other planned audit
procedures. Information may come to the auditor’s attention that differs
significantly from the information on which the risk assessment was based. For
example, the extent of misstatements that the auditor detects by performing
substantive procedures may alter the auditor’s judgment about the risk
assessments and may indicate a material weakness in internal control. In addition,
analytical procedures performed at the overall review stage of the audit may
indicate a previously unrecognized risk of material misstatement. In such
circumstances, the auditor may need to reevaluate the planned audit procedures,
based on the revised consideration of assessed risks for all or some of the classes
of transactions, account balances, or disclosures and related assertions. Paragraph
119 of PSA 315 contains further guidance on revising the auditor’s risk
assessment.

68. The concept of effectiveness of the operation of controls recognizes that some
deviations in the way controls are applied by the entity may occur. Deviations
from prescribed controls may be caused by such factors as changes in key
personnel, significant seasonal fluctuations in volume of transactions and human
error. When such deviations are detected during the performance of tests of
controls, the auditor makes specific inquiries to understand these matters and their
potential consequences, for example, by inquiring about the timing of personnel
changes in key internal control functions. The auditor determines whether the
tests of controls performed provide an appropriate basis for reliance on the
controls, whether additional tests of controls are necessary, or whether the
potential risks of misstatement need to be addressed using substantive procedures.

69. The auditor cannot assume that an instance of fraud or error is an isolated
occurrence, and therefore considers how the detection of a misstatement affects
the assessed risks of material misstatement. Before the conclusion of the audit,
the auditor evaluates whether audit risk has been reduced to an acceptably low
level and whether the nature, timing, and extent of the audit procedures may need
to be reconsidered. For example, the auditor reconsiders the following:

• The nature, timing, and extent of substantive procedures.

• The audit evidence of the operating effectiveness of relevant controls,

including the entity’s risk assessment process.
 PSA 330
- 21 -

70. The auditor should conclude whether sufficient appropriate audit evidence
has been obtained to reduce to an acceptably low level the risk of material
misstatement in the financial statements. In developing an opinion, the auditor
considers all relevant audit evidence, regardless of whether it appears to
corroborate or to contradict the assertions in the financial statements.

71. The sufficiency and appropriateness of audit evidence to support the auditor’s
conclusions throughout the audit are a matter of professional judgment. The
auditor’s judgment as to what constitutes sufficient appropriate audit evidence is
influenced by such factors as the following:

• Significance of the potential misstatement in the assertion and the likelihood

of its having a material effect, individually or aggregated with other potential
misstatements, on the financial statements.

• Effectiveness of management’s responses and controls to address the risks.

• Experience gained during previous audits with respect to similar potential

misstatements.

• Results of audit procedures performed, including whether such audit

procedures identified specific instances of fraud or error.

• Source and reliability of the available information.

• Persuasiveness of the audit evidence.

• Understanding of the entity and its environment, including its internal control.

72. If the auditor has not obtained sufficient appropriate audit evidence as to a
material financial statement assertion, the auditor should attempt to obtain
further audit evidence. If the auditor is unable to obtain sufficient
appropriate audit evidence, the auditor should express a qualified opinion or
a disclaimer of opinion. See PSA 700, “The Auditor’s Report on Financial
Statements” for further guidance.
 PSA 330
- 22 -

Documentation

73. The auditor should document the overall responses to address the assessed
risks of material misstatement at the financial statement level and the nature,
timing, and extent of the further audit procedures, the linkage of those
procedures with the assessed risks at the assertion level, and the results of the
audit procedures. In addition, if the auditor plans to use audit evidence
about the operating effectiveness of controls obtained in prior audits, the
auditor should document the conclusions reached with regard to relying on
such controls that were tested in a prior audit. The manner in which these
matters are documented is based on the auditor’s professional judgment. PSA
230, “Documentation” establishes standards and provides guidance regarding
documentation in the context of the audit of financial statements.

Effective Date

74. This PSA is effective for audits of financial statements for periods beginning on
or after December 15, 2004.

Acknowledgment

75. This PSA is based on International Standard on Auditing (ISA) 330, “The
Auditor’s Procedures in Response to Assessed Risks,” issued by the International
Auditing and Assurance Standards Board.

76. There are no significant differences between this PSA and ISA 330.

Public Sector Perspective

1. When carrying out audits of public sector entities, the auditor takes into account
the legislative framework and any other relevant regulations, ordinances or
ministerial directives that affect the audit mandate and any other special auditing
requirements. Such factors might affect, for example, the extent of the auditor’s
discretion in establishing materiality and judgments on the nature and scope of
audit procedures to be applied. Paragraph 3 of this PSA may have to be applied
only after giving consideration to such restrictions.
 PSA 330
- 23 -

This Philippine Standard on Auditing 330 was unanimously approved on

August 30, 2004 by the members of the Auditing Standards and Practices Council:

Benjamin R. Punongbayan, Chairman Antonio P. Acyatan, Vice Chairman

Felicidad A. Abad David L. Balangue

Eliseo A. Fernandez Nestorio C. Roraldo

Joaquin P. Tolentino Editha O. Tuason

Joycelyn J. Villaflores Horace F. Dumlao

Ester F. Ledesma Manuel O. Faustino

Erwin Vincent G. Alcala Froilan G. Ampil

Eugene T. Mateo Flerida V. Creencia

Roberto G. Manabat